---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Use as filter criteria for SAML

# Use Identity Provider Attribute as Filter Criteria for SAML {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer

Use the Identity Provider (IDP) attribute from the Security Assertion Markup Language (SAML) response as a filter criteria for authentication policy.

## Vorbereitungen

Role required: adaptive_auth_admin

You can create session access policy using policy context (Pre-Authentication, Post Authentication, multi-factor authentication) and filter criteria (Role, Group, IP, Location)
with policy inputs and conditions.

The following procedure shows steps to configure the IdP attribute from the SAML response as a policy input to control authentication in the Post Authentication Context, Multi-factor authentication (MFA) Context, and Zero Trust - Policy based session access.

The Okta IDP attributes are as displayed in the following
screenshot. You should set the Use in Adaptive Authentication as true to use it in the Post Authentication Context, Multi-factor authentication (MFA) Context, and Zero Trust - Policy based session access policies.  
Hinweis:  
Policies in the post-authorization, MFA, Zero Trust - Policy based session access execute after the users enter the credentials or SSO response.

## Prozedur

1. Use of IDP attribute in Post Authentication Policy Context.  
   Example: Configuring to enable logins from the Okta IDP attributes if the device is trusted.
   1. Navigate to AllAdaptive AuthenticationAuth Policy ContextsPost Authentication Policy Context..
   2. Select Allow Policy and open the policy record.
   3. In the Policy Input, create the Policy Input and Policy Condition.  
      * Policy Input: Add device_trusted-okta.

      * Policy Conditions: device_trusted-okta is <kbd class="ph userinput">trusted</kbd> and Identity Provider is <kbd class="ph userinput">okta</kbd>.

      {#use-idp-filter-criteria__ul_zdh_qyl_gxb}

      Based on this configuration, when the device is trusted from the Okta (IdP), then the user is authenticated to the instance.

      For more information on how to create Post Authentication Context with Policy and Condition, see [Post-authentication context](https://servicenow-prod.fluidtopics.net/WP0WKYBprUP8geObixGBXw "The Post Authentication policy context defines how and when a policy is enforced during the login process. The policy used in this context executes after your users see a login screen.").
   {#use-idp-filter-criteria__substeps_zcl_dj2_1yb}
2. Use of IDP attribute in MFA Policy Context.  
   Example: Configuring to enable MFA from the Okta IDP attributes if the device isn't trusted.
   1. Navigate to AllAdaptive AuthenticationAuth Policy ContextsMFA Authentication Policy Context..
   2. In the Policy Input, create the Policy Input and Policy Condition.  
      * Policy Input: Add device_trusted-okta.

      * Policy Conditions: device_trusted-okta is <kbd class="ph userinput">not_trusted</kbd> and Identity Provider is <kbd class="ph userinput">okta</kbd>.

      {#use-idp-filter-criteria__ul_vjb_fj2_1yb}

      Based on this configuration, when the device is not-trusted from the Okta (IdP), then the user shown a second factor authentication to log in to the instance.

      For more information on how to create MFA Context with Policy and Condition, see [Multi-factor Authentication context](https://servicenow-prod.fluidtopics.net/J4~REDzsHgZRhtvBg6xTbw "The Multi-factor Authentication (MFA) policy context uses a policy to define how and when MFA is enforced during the login process.").
   {#use-idp-filter-criteria__substeps_ujb_fj2_1yb}
3. Use of IDP attribute in Zero Trust - Policy based session access.  
   Example: Configuring to reduce the privilege of <kbd class="ph userinput">Itil</kbd> role from Okta IDP attributes if the device isn't trusted.
   1. Navigate to AllZero Trust AccessSession Access Role Configurations.
   2. Create a Session Access role configuration.
   3. In the Policy Input, create the Policy Input and Policy Condition.  
      * Policy Input: Add device_trusted-okta and has itil role.

      * Policy Conditions: device_trusted-okta is <kbd class="ph userinput">not_trusted</kbd>, Identity Provider is <kbd class="ph userinput">okta</kbd>, and has itil role is <kbd class="ph userinput">true</kbd>.

      {#use-idp-filter-criteria__ul_kqg_qj2_1yb}

      Based on this configuration, when the <kbd class="ph userinput">itil</kbd> user using a device that is not-trusted from the Okta (IdP), then the user's privileges are reduced for the logged in session.

      For more information on how to create Zero Trust - Policy based session access with Policy and Condition, see [Zero Trust Access (ZTA)](https://servicenow-prod.fluidtopics.net/NxCt_r6~52TWhm29xo89mQ "Zero Trust Access (ZTA) is a security model that assumes that no user or device is trusted by default.").
   {#use-idp-filter-criteria__substeps_jqg_qj2_1yb}